Posts

On an Armbian machine used as a bypass router, both sing-box and WireGuard are running side by side. The router itself resolves internal domain names fine, yet downstream clients that point at it as their DNS server time out every time. The root cause turned out not to be the DNS matching rules, but rather that the traffic sing-box sends to its upstream DNS was choosing the wrong egress interface. ...

When Docker uses HTTPS certificates issued by a private CA (such as step-ca), it is important to distinguish between Docker Engine pulling images and an application inside a container accessing HTTPS. Their certificate trust stores may not be the same. I. Docker Engine Trusting a Private CA This applies to docker login, docker pull, and docker push when accessing a private image registry. Trust Only the Specified Registry (Recommended) Assume the registry address is registry.example.com:5000: ...

After deploying sing-box TUN on Armbian, I encountered a rather counterintuitive issue: IPv6 ping works, but IPv6 HTTPS connections time out after enabling auto_redirect. The eventual finding was that the problem was not with IPv6 public routing or the proxy node, but rather that the Linux loopback interface lo was missing the ::1/128 address. This article documents the diagnostic process and the fix. Environment Linux: Armbian, ARM64, 6.18-series kernel sing-box: 1.14.x Network management: Netplan + NetworkManager Transparent proxy: TUN, auto_route: true, auto_redirect: true IPv6: Automatically configured by the upstream; the interface already has a global IPv6 address and an RA default route To protect privacy, this article omits the actual public IP addresses, MAC addresses, router address, domain names, and custom internal routing table numbers. The ULA addresses and test targets in the following examples are for demonstration purposes. ...

When running UFW and sing-box TUN simultaneously on a Linux bypass router, an easily misdiagnosed failure may occur: sing-box runs normally on the local machine, but LAN devices cannot access the Internet through the bypass router. Even if the TCP port that was blocked at the time is allowed, the problem may reappear after sing-box is restarted. This article documents an actually observed cause and a fix pending regression validation. All examples use documentation-reserved addresses and do not correspond to a real network. ...

Automatically Banning Malicious IPs on a Debian Server with CrowdSec Public-facing servers face all kinds of automated scanning every single day. Even when you never advertise a service address, your SSH port still routinely receives login attempts against usernames like root, admin and test. Web services may get probed for paths such as .env, wp-admin and phpinfo.php. Most of these requests come from automated scanners. They may not amount to an actual intrusion, but they generate a huge amount of pointless log noise and widen the exposed attack surface. ...

The history of China’s straw burning ban policy is, in effect, a microcosm of the country’s agricultural modernization, rural energy transition, environmental governance, and the evolution of grassroots administrative practice. The most important historical conclusion is this: large-scale straw burning was not a problem that existed in China throughout history, nor did the prohibition begin only in recent years. The modern straw burning ban system was gradually established in the 1990s, took the form of a nationwide management regulation in 1999, was visibly strengthened around 2008, and was further incorporated into the air pollution prevention and control system after 2013. ...

The 2008 Olympics guarantee was an important precedent for comprehensive bans. Jiangsu had already set a province-wide ban target in 2009. After 2013, satellite fire-point data, performance assessment, and fiscal subsidies together changed how the policy was implemented.

Why OpenList Quark WebDAV Uploads Use Excessive Memory: Causes and Optimization When using rclone to upload local files to Quark Cloud Drive through OpenList’s WebDAV interface, OpenList’s memory usage may increase significantly, even triggering a container OOM. Investigation found that the key factors are the full-file cache used before uploads by the Quark driver and the file page cache included in container statistics. This analysis focuses on OpenList v4.2.7, the standard Quark driver, Docker, and cgroup v2. The implementation should be rechecked for other drivers and versions. ...